Elastic aggregation on specific values from within one field

Question

I am migrating my db from postgres to elasticsearch. My postgres query looks like this:

select site_id, count(*) from r_2332 where site_id in ('1300','1364') and date >= '2021-01-25' and date <= '2021-01-30'

The expected result is as follows:

site_id   count
1300       1234
1364       2345

I am trying to derive the same result from elasticsearch aggs. I have tried the following:

GET /r_2332/_search
{
   "query": {
    "bool" : {
      "should" : [
        {"match" : {"site_id": "1300"}},
        {"match" : {"site_id": "1364"}}
      ],"minimum_should_match": 1
    }
  },
    "aggs" : {
      "footfall" : {
        "range" : {
          "field" : "date",
          "ranges" : [
            {
              "from":"2021-01-21",
              "to":"2021-01-30"
            }
            ]
        }
      }
    }
}

This gives me the result as follows:

"aggregations":{"footfall":{"buckets":[{"key":"2021-01-21T00:00:00.000Z-2021-01-30T00:00:00.000Z","from":1.6111872E12,"from_as_string":"2021-01-21T00:00:00.000Z","to":1.6119648E12,"to_as_string":"2021-01-30T00:00:00.000Z","doc_count":2679}]}

and this:

GET /r_2332/_search
{
   "query": {
    "terms": {
      "site_id": [ "1300", "1364" ],
      "boost": 1.0
    }
  },
    "aggs" : {
      "footfall" : {
        "range" : {
          "field" : "date",
          "ranges" : [
            {
              "from":"2021-01-21",
              "to":"2021-01-30"
            }
            ]
        }
      }
    }
}

This provided the same result:

"aggregations":{"footfall":{"buckets":[{"key":"2021-01-21T00:00:00.000Z-2021-01-30T00:00:00.000Z","from":1.6111872E12,"from_as_string":"2021-01-21T00:00:00.000Z","to":1.6119648E12,"to_as_string":"2021-01-30T00:00:00.000Z","doc_count":2679}]}

How do I get the result separately for each site_id?

Answer 1

You can use a combination of terms and range aggregation to achieve your task

Adding a working example with index data, search query and search result

Index Data:

{
    "site_id":1365,
    "date":"2021-01-24"
}
{
    "site_id":1300,
    "date":"2021-01-22"
}
{
    "site_id":1300,
    "date":"2020-01-22"
}
{
    "site_id":1364,
    "date":"2021-01-24"
}

Search Query:

{
  "size": 0,
  "aggs": {
    "siteId": {
      "terms": {
        "field": "site_id",
        "include": [
          1300,
          1364
        ]
      },
      "aggs": {
        "footfall": {
          "range": {
            "field": "date",
            "ranges": [
              {
                "from": "2021-01-21",
                "to": "2021-01-30"
              }
            ]
          }
        }
      }
    }
  }
}

Search Result:

"aggregations": {
    "siteId": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": 1300,
          "doc_count": 2,
          "footfall": {
            "buckets": [
              {
                "key": "2021-01-21T00:00:00.000Z-2021-01-30T00:00:00.000Z",
                "from": 1.6111872E12,
                "from_as_string": "2021-01-21T00:00:00.000Z",
                "to": 1.6119648E12,
                "to_as_string": "2021-01-30T00:00:00.000Z",
                "doc_count": 1                           // note this
              }
            ]
          }
        },
        {
          "key": 1364,
          "doc_count": 1,
          "footfall": {
            "buckets": [
              {
                "key": "2021-01-21T00:00:00.000Z-2021-01-30T00:00:00.000Z",
                "from": 1.6111872E12,
                "from_as_string": "2021-01-21T00:00:00.000Z",
                "to": 1.6119648E12,
                "to_as_string": "2021-01-30T00:00:00.000Z",
                "doc_count": 1                         // note this
              }
            ]
          }
        }
      ]
    }
  }